Information Security Management

The current standard is ISO/IEC 27001:2022, with ISO/IEC 27001:2022/Amd 1:2024 applying the climate action amendment. ISO lists the 2024 amendment as published and applicable to ISO/IEC 27001:2022. (ISO)

Our platform supports ISO/IEC 27001:2022 and includes the expectation that organisations consider whether climate-related issues are relevant to the intended outcomes of the information security management system.

ISO/IEC 27001 helps you show that information security is managed through a formal system, not left to chance. It expects you to understand your information assets, assess risks, select appropriate controls, monitor performance, respond to incidents and continually improve.

In simple terms, it helps you answer these questions. What information do we need to protect? What could go wrong? How likely is it? What would the impact be? What controls do we need? Are those controls working? How do we respond if something happens?

The platform guides you through the management system clauses and the Annex A control areas. You upload evidence such as policies, risk assessments, access control records, supplier checks, incident logs, backup records, monitoring records or training evidence. The AI review checks whether the evidence appears to support the requirement and highlights where more detail may be needed.

This helps organisations avoid the common problem of having technical controls in place but not being able to evidence them clearly during audit.

We review whether your organisation understands the internal and external issues that affect information security. This may include technology, regulation, customer requirements, remote working, supply chain risk, cyber threats, hosting arrangements and business continuity needs.

Typical evidence may include a context review, interested parties register, ISMS scope, information security risk register, business process map, legal register and management review minutes.

We check whether the scope of the information security management system is clear and accurate. This should include the services, locations, systems, data types, departments and interfaces covered by the ISMS.

Typical evidence may include an ISMS scope statement, network overview, asset inventory, service description, organisational chart, system architecture overview and list of outsourced services.

We review whether top management supports the ISMS and whether information security responsibilities are clearly defined.

Typical evidence may include the information security policy, role descriptions, governance structure, responsibilities matrix, board or leadership meeting minutes, security objectives and communications.

This is the heart of ISO/IEC 27001. We check whether information security risks are identified, assessed and treated using a defined method.

Typical evidence may include the risk assessment methodology, information security risk register, risk treatment plan, statement of applicability, control ownership records, risk acceptance records and management approval.

The Statement of Applicability explains which Annex A controls apply, which do not, and why. We review whether it is complete, accurate and linked to your risk assessment and risk treatment decisions.

Typical evidence may include the Statement of Applicability, Annex A control mapping, justification for exclusions, control implementation evidence and approval records.

We review how information security responsibilities are managed before, during and after employment or engagement.

Typical evidence may include screening records where appropriate, employment terms, confidentiality agreements, induction records, information security training, acceptable use policy, disciplinary process and leaver records.

We check how users are granted, reviewed, changed and removed from systems.

Typical evidence may include user access records, joiner-mover-leaver process, access review reports, privileged access records, MFA settings, password policy, role-based access permissions and leaver evidence.

We review whether information assets are identified, classified and protected.

Typical evidence may include asset registers, data classification rules, device inventories, acceptable use records, encryption controls, removable media controls, disposal records and information handling procedures.

We check how information security risks are managed where suppliers, hosting providers, software platforms or outsourced services are used.

Typical evidence may include supplier approval records, contracts, data processing agreements, security questionnaires, supplier reviews, cloud configuration evidence, service level agreements and incident notification clauses.

We review whether appropriate technical controls are in place and operating effectively.

Typical evidence may include vulnerability scanning, patching records, endpoint protection, firewall rules, logging and monitoring records, backup records, restore tests, change control records, secure configuration standards and penetration test outputs where applicable.

We check how information security incidents are reported, investigated, contained, resolved and reviewed.

Typical evidence may include incident response procedure, incident logs, post-incident reviews, lessons learned, communication records, escalation paths and corrective actions.

We review whether the organisation has considered how information security and service continuity would be maintained during disruption.

Typical evidence may include business continuity plans, disaster recovery arrangements, backup and restore tests, continuity exercises, recovery time objectives and management review outputs.

We check whether the ISMS is monitored, audited, reviewed and improved.

Typical evidence may include security KPIs, internal audit reports, management review minutes, corrective actions, risk review records, control testing and improvement plans.

The platform produces a clear remote audit output showing where your ISMS appears to meet ISO/IEC 27001, where more evidence may be needed, and where risks, nonconformities or improvement opportunities may need attention.

This can support certification preparation, supplier assurance, client due diligence, internal audit activity and ongoing security governance.

ISO/IEC 27001 helps you prove that information security is managed, monitored and improved. Our AI-supported remote audit helps you turn policies, risks and technical controls into clear evidence that clients, auditors and stakeholders can understand.